java - Get groups and users from LDAP -
hi trying fetch posixgroup ldap , users in group. code below have done far, returns me groups not sure how users these groups. please guide me approach good? or should go first getting users , based on gid group name?
public static void main(string[] args) { hashtable env = new hashtable(); env.put(context.initial_context_factory,"com.sun.jndi.ldap.ldapctxfactory"); env.put(context.provider_url,"ldap://192.168.*.*:389"); env.put(context.url_pkg_prefixes, "com.sun.jndi.url"); env.put(context.referral, "ignore"); env.put(context.security_authentication, "simple"); env.put(context.security_principal, "cn=manager,dc=*,dc=*"); env.put(context.security_credentials, "****"); dircontext ctx; try { ctx = new initialdircontext(env); } catch (namingexception e) { throw new runtimeexception(e); } namingenumeration results = null; try { searchcontrols controls = new searchcontrols(); controls.setsearchscope(searchcontrols.subtree_scope); results = ctx.search("ou=path,dc=*,dc=*", "(objectclass=posixgroup)",controls); // go through each item in list while (results.hasmore()) { searchresult nc = (searchresult)results.next(); attributes att= nc.getattributes(); system.out.println("group name "+ att.get("cn").get(0)); system.out.println("gid "+ att.get("gidnumber").get(0)); } } catch (namenotfoundexception e) { system.out.println("error : "+e); } catch (namingexception e) { throw new runtimeexception(e); } { if (results != null) { try { results.close(); } catch (exception e) { system.out.println("error : "+e); } } if (ctx != null) { try { ctx.close(); } catch (exception e) { system.out.println("error : "+e); } } } }
querying users in group
it depends attribute used groups in directory denote membership. posixgroup
uses memberuid
username value (defined in rfc 2307). there other possible attributes (member, uniquemember) , values (dn) check directory uses.
so in order load users group, have to:
- query group, example filter
(&(objectclass=posixgroup)(cn=<group name>))
- iterate through values of
memberuid
in group, each:- query user object
(&(objectclass=posixaccount)(uid=<memberuid>))
- then can access user attributes
uidnumber
.
- query user object
this not efficient way of doing because generate lots of small queries, far know, ldap has no means join group entry user entries references in single result (unlike sql).
you optimise bit limiting results attributes need: gidnumber
group query , uidnumber
user query. using either searchcontrols.setreturningattributes()
or version of dircontext.search()
takes attributestoreturn
argument. doesn't reduce number of queries though, volume of data returned.
some more general notes ldap usage
- if queries have large number of results (for example "all users"), might hit directory's result size limit (typically 5000) , partial results.
- when modifying group membership information, have update both
posixaccount
,posixgroup
objects (unless directory server it, doubt will), otherwise becomes inconsistent.
Comments
Post a Comment